Compliance
No product can meet the requirements of NIS2 on its own
A product can help you meet some of the requirements in laws and standards, but never all of them. That is why we show exactly which requirements XoT helps with.
NIS2
NIS2 is the EU directive on cybersecurity. In Sweden it applies through the Swedish Cybersecurity Act. We go through the ten areas in which the directive sets requirements.
CER
CER is the EU directive on the resilience of essential services. Most EU countries already apply it, and Sweden proposes a law from 1 January 2027.
IEC 62443
IEC 62443 is a series of standards for security in industrial control systems. It describes how you divide a plant into zones and sets seven foundational requirements.
Cyber Resilience Act
The Cyber Resilience Act is an EU regulation. It sets requirements for products with digital elements, meaning both hardware and software. We explain what it means for you as a buyer.
Machinery Regulation
From 20 January 2027 cybersecurity is a requirement for machinery. We show what XoT helps machine builders with.
ISO 27001
ISO 27001 is a standard for how an organisation manages information security. We show which Annex A controls XoT helps with.
NIST
NIST publishes security guidance, including SP 800-82 for OT. We show which SP 800-53 controls XoT helps with.
GMP and Annex 11
Annex 11 of the EU GMP guidelines sets requirements for computerised systems in pharmaceutical manufacturing. A new draft requires systems that cannot be updated to be isolated.
21 CFR Part 11
The FDA's rule for electronic records and signatures. XoT is not itself in scope, but it protects the systems that are.
Our position
What XoT helps with
NIS2 and IEC 62443 both set requirements for how you control access to your systems. XoT helps with several of those requirements.
But some requirements are outside what XoT does. We would rather tell you that ourselves than have you find out later.
XoT helps with
- controlling who gets access
- encrypting the traffic
- checking the user's identity twice a minute
- limiting which traffic reaches the equipment
- logging who has been connected
- logging every change to policies and access rights
- sending logs to your SIEM
XoT does not help with
- risk analysis
- procedures for handling incidents
- plans to keep the business running during disruptions
- security training
- contracts with vendors and following them up
- checking that the measures work
What we write on these pages is our interpretation of the regulations. It is not legal advice. Always check what applies to your sector.
Xertified as a supplier
Assess us as a supplier
These pages show how XoT helps you with your requirements. Are you assessing us as a supplier? Then the answers are on two other pages.
Requirements that apply to Xertified
Which laws and standards apply to us and to XoT? We show our status for NIS2, the Cyber Resilience Act, CE marking and more.
Quality and security
How we develop, test and update XoT. Five years of support and free security updates.
Do you need material for a procurement?
We answer technical questions in requirement specifications and explain what XoT does.